book-and-advance-artists
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to install the vendor's official command-line interface (ticketfairy) from the public NPM registry.
- [COMMAND_EXECUTION]: The agent uses the ticketfairy CLI to interact with the platform API for operations like managing venue calendars, placing holds, and processing settlements.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions meant to influence the agent's behavior.
- Ingestion points: The agent is instructed to read content from uploaded files such as tour books, artist riders, contracts, and email correspondence (SKILL.md).
- Boundary markers: The instructions explicitly require the agent to wait for user confirmation ('waits for your yes first') before performing actions based on the processed data.
- Capability inventory: The skill has the ability to send emails to external agents and modify venue records via the CLI and MCP tools.
- Sanitization: No specific data sanitization or filtering logic is described; the skill relies on human-in-the-loop verification of LLM-extracted data.
Audit Metadata